chore(deps): bump actions/setup-python from 5 to 7 - #80
Conversation
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v5...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
dependencies
srpatcha
left a comment
srpatcha
left a comment
There was a problem hiding this comment.
Review — eDB#80 "chore(deps): bump actions/setup-python from 5 to 7"
head: 4bd45e5 author: app/dependabot ci: the build/test workflow never ran — the only reported checks are Analyze (Python), CodeQL and assign, all pass
Verdict: The bump itself is safe by inspection: v7's only removed input is pip-install, which none of the ten call sites use, and every site passes only python-version (plus cache: pip at ci.yml:28), both unchanged across v5→v7. The problem is that this PR edits ci.yml and CI — eDB did not run on it, so a change to the test workflow carries zero build evidence — and its green overall tick is composed entirely of code scanning and auto-assign. Root cause verified below, and it is fixable by a rebase.
Findings
| # | Severity | File:line | Finding | Recommended fix |
|---|---|---|---|---|
| 1 | High | .github/workflows/ci.yml (at base 5e436bd6), lines 6-7 |
CI — eDB never triggered on this PR, and its absence reads as success. At this PR's base commit 5e436bd63d53b14b5b75f5a0cc5e816642691388 the workflow carried pull_request: branches: [main], while the PR targets master — so the trigger silently did not match. The Test (Python …) matrix is absent, not failing. master has since been fixed (PR #70, 6d53641, now branches: [master, main]), but this PR branched before that, so it still runs against the old trigger. This is exactly the shape recorded in the required_status_checks addendum of 2026-09-03 for eDB#71/#72/#73 — #80 and #81 are two more instances of the same base. |
Rebase onto current master. That alone makes CI — eDB trigger and gives this PR real evidence. Dependabot will not do it — see finding 4 — so it needs a human git rebase and force-push to the dependabot branch, or close-and-reopen by hand. |
| 2 | High | .github/workflows/ci.yml:33 and the matrix at :16-18 | The workflow this PR edits has not had a green run since at least 2026-05, and fails in two independent ways. Run 33472965435 on master (2026-09-01): six of the nine matrix legs concluded failure in 9-40 seconds, and three legs sat queued from 05:16:30Z to 2026-09-02T05:16:30Z — exactly 24h — and were then cancelled, which is where the 24h0m2s run duration on the last three master runs comes from. The fast failures are ci.yml:33 pip install -r requirements.txt; no requirements.txt exists on master. The starved legs are a separate problem: runner allocation for the macos-13/windows-2022 legs never happens and the run burns a full day before cancellation. |
The requirements.txt half is already fixed in open PR #82 (autofix/ci-install-project-deps, "install the project and its dev extra instead of a requirements.txt that does not exist") — do not open a duplicate; land #82 first. The queue-starvation half is not covered by #82 and needs its own change: add timeout-minutes to the test job so a leg that cannot get a runner fails in minutes instead of a day. |
| 3 | Medium | .github/workflows/ci.yml:38,42,55 | Three verifications whose results are discarded, in the file this PR edits. :38 continue-on-error: true on ruff check; :42 on mypy; :55 on the performance benchmark. Lint and type-check therefore cannot fail the job regardless of what they report. Per .ai/reviewer.md — "a disabled test, a loosened lint, a removed assertion … treat these as findings regardless of the reason given" — and per the §28.2 proposal of 2026-09-02, this is the continue-on-error case named explicitly. Pre-existing, not introduced here. |
Out of scope for a dependabot bump, and it should not be asked to carry it. Fix after #82 lands, once the job can reach these steps at all: drop continue-on-error from :38 and :42, or move ruff/mypy into their own non-required job so the suppression is visible rather than implicit. |
| 4 | Medium | Repository state | Dependabot was removed from this repo after this PR was opened. .github/dependabot.yml does not exist on origin/master — deleted by #68, "chore(ci): remove Dependabot, add Claude + Copilot code review", merged 2026-09-01. This PR was opened 2026-08-31. Consequences: nothing will rebase it (finding 1), nothing will close it if superseded, and its own "The following labels could not be found: github-actions" comment is now permanently unactionable. Eleven dependabot PRs (#71-#81) are in this orphaned state. |
Make it a deliberate decision rather than letting them rot: triage #71-#81 in one pass, rebase and merge the ones you want, close the rest with a note pointing at #68. The org-wide gap this leaves is already filed as the proposal of 2026-09-03, "Dependabot was disabled org-wide, and no section of the design owns dependency-vulnerability monitoring". |
| 5 | Low | Repo settings — master branch protection |
gh api repos/embeddedos-org/eDB/branches/master/protection → required_status_checks: null, required_approving_review_count: 1. Nothing gates merge on a check. Rated Low here only because the effect is already covered by finding 1 and the PR is BLOCKED/REVIEW_REQUIRED, so a human must still approve. Already filed as the §28.3 proposal of 2026-09-03 and its addendum, which names eDB. |
Require CI — eDB once #82 makes it capable of going green. Requiring it while master is red would block everything. |
Not a finding, recorded as checked. setup-python v6/v7 changes are: ESM migration, SHA-pinned internals, @actions/cache upgraded to 6.2.0, stderr warnings reclassified as warnings rather than error annotations, manifest fetch validated and retried, RHEL support with the Linux distro added to cache keys, EOL Python versions dropped from the action's own test fixtures, and pip-install removed. Grep of all six changed workflow files shows every setup-python step passes only python-version, with cache: pip additionally at ci.yml:28 — no pip-install anywhere, so the one removed input is not in use. v6 requires Node 24 (Actions Runner ≥ 2.327.1), satisfied by the ubuntu-22.04 / macos-13 / windows-2022 hosted runners in the matrix.
Architecture conformance
Conforms. Infrastructure-tier change (master design §21, "Infrastructure — .github, website, docs, CI templates") to a Tier-3 Advanced repository (§21, "eAI, eNI, eDB"). No source file, #include, link line or manifest entry, so §5.1 dependency direction is untouched, and no public API or ABI moves, so §23.2's contracts are unaffected. Findings 1-3 bear on §28's evidence policy — a repository whose test workflow has not gone green since May cannot support an Implemented or Validated claim — but each of those gaps is already filed: §28.2 (2026-09-02, checks that verify nothing), §28.3 (2026-09-03, the trunk itself must build), the required_status_checks addendum (2026-09-03, which already names eDB and the branches: [main] trigger mismatch), and the Dependabot-shutdown proposal (2026-09-03). No new proposal appended — these PRs produced no gap that is not already written down.
Proposed changes
Order matters, and this PR is last:
- Land #82 so
ci.yml:33stops failing on a file that does not exist (finding 2). - Add
timeout-minutesto thetestjob so a runner-starved leg fails in minutes, not 24 hours (finding 2). - Rebase this PR onto
mastersoCI — eDBactually triggers (finding 1). Only then does merging it mean anything. - Separately, triage the eleven orphaned dependabot PRs (finding 4) and drop the
continue-on-errorsuppressions (finding 3).
Verification I ran
gh pr view 80 --json baseRefOid→5e436bd6…;git show 5e436bd6:.github/workflows/ci.yml→pull_request: branches: [main]against a PR targetingmaster. This is the direct evidence for finding 1.gh run list --workflow=ci.yml --limit 8→ every run since 2026-05 concludedfailure; the last threemasterruns each took24h0m2s.gh run view 33472965435 --json jobs→ six legsfailure(9-40s), three legscancelledafter exactly 24h ofqueued. This is the evidence for both halves of finding 2.git show origin/master:.github/workflows/ci.yml→:33pip install -r requirements.txt;git show origin/master:requirements.txt→ does not exist.:38,:42,:55continue-on-error: true.git show origin/master:.github/dependabot.yml→fatal: … exists on disk, but not in 'origin/master';gh run listshows #68 "chore(ci): remove Dependabot" merged 2026-09-01. Evidence for finding 4.gh pr list→ PR #82autofix/ci-install-project-depsis open and already covers therequirements.txtdefect, which is why I opened no fix PR for it.gh api repos/embeddedos-org/eDB/branches/master/protection→required_status_checks: null, reviews1.- Grep for
setup-pythonacross the six changed workflows onorigin/master→ inputs arepython-versioneverywhere pluscache: pipatci.yml:28; nopip-install.
Not checked
- Nothing was executed. No workflow ran with
setup-python@v7, and none can until finding 1 is addressed. The safety of the bump is established by reading the removed-input list against the actual call sites — sound for that question, not a substitute for a run. - I did not open a job log for the three starved legs, so I have not confirmed which OS legs they are. The
name: Test (Python ${{ matrix.python-version }})atci.yml:13omitsmatrix.os, so all nine legs report under three names and the API response does not distinguish them. The 24hqueuedduration is consistent withmacos-13/windows-2022runner starvation; I am inferring the OS, not reporting it. - I did not verify that
setup-python@v7resolves Python 3.10 onmacos-13, which is the leg most likely to be affected by the action dropping EOL versions from its fixtures. Nothing has run there. - The local eDB checkout has diverged from
origin/master(1 ahead, 3 behind) with a clean tree; every file above was read fromorigin/masteror from the PR base viagit show. I did not stash, reset, rebase or check out anything.
Automated architecture review of 4bd45e5f3b17 — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.
1 participant
Bumps actions/setup-python from 5 to 7.
Release notes
Sourced from actions/setup-python's releases.
... (truncated)
Commits
5fda3b9Pin SHA commits and update docs with latest versions (#1338)4ab7e95Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-00f3a009Remove the pip-install input (#1336)f8cf429Migrate to ESM and upgrade dependencies (#1330)54baeeaValidate and retry manifest fetch to prevent silent failures (#1332)c709277Annotation code fix (#1335)6849080remove EOL Python versions and Bumps numpy text fixture (#1333)0903b46Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)ece7cb0Fix pip cache error handling on Windows. (#1040)1d18d7aUpdate advanced-usage.md (#811)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)